{{- if and .Values.ingress .Values.ingress.marketplace .Values.ingress.marketplace.enabled -}}
# Dedicated ServiceAccount per SME microservice.
#
# The `default` SA was being used by everything (see issue #76), which means
# a token compromise on any single pod would grant the same default-SA
# permissions to the attacker everywhere. By giving each service its own SA
# we get (a) isolated identities for audit, (b) a per-service blast radius
# for any future RoleBinding, and (c) a clear invariant: only the
# provisioning SA may talk to the Kubernetes API.
#
# All SAs below set automountServiceAccountToken: false at the SA level.
# None of these services (except provisioning — handled in provisioning.yaml)
# talk to the Kubernetes API, so they don't need a mounted SA token and the
# `default` SA's token was pure blast-radius expansion.
#
# Note: `automountServiceAccountToken: false` on the SA is overridden at the
# pod spec level if the pod sets it to true. For defence in depth the pod
# spec is also being set to false in each deployment manifest. SA-level flag
# protects against a future deployment that forgets to set it.
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: auth
  namespace: sme
automountServiceAccountToken: false
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: catalog
  namespace: sme
automountServiceAccountToken: false
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: gateway
  namespace: sme
automountServiceAccountToken: false
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tenant
  namespace: sme
automountServiceAccountToken: false
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: domain
  namespace: sme
automountServiceAccountToken: false
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: billing
  namespace: sme
automountServiceAccountToken: false
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: notification
  namespace: sme
automountServiceAccountToken: false
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: marketplace
  namespace: sme
automountServiceAccountToken: false
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: console
  namespace: sme
automountServiceAccountToken: false
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin
  namespace: sme
automountServiceAccountToken: false
{{- end }}
